Analysis of microseismic signals collected on an unstable rock face in the Italian Prealps

S U M M A R Y In this work we present the analysis of more than 9000 signals collected from February 2013 to January 2016 by a microseismic monitoring network installed on a 300 m high limestone cliff in the Italian Prealps. The investigated area was affected by a major rockfall in 1969 and several other minor events up to nowadays. The network features five three-component geophones and a weather station and can be remotely accessed thanks to a dedicated radio link. We first manually classified all the recorded signals and found out that 95 per cent of them are impulsive broad-band disturbances, while about 2 per cent may be related to rockfalls or fracture propagation. Signal parameters in the time and frequency domains were computed during the classification procedure with the aim of developing an automatic classification routine based on linear discriminant analysis. The algorithm proved to have a hit rate higher than 95 per cent and a tolerable false alarm rate and it is now running on the field PC of the acquisition board to autonomously discard useless events. Analysis of lightning data sets provided by the Italian Lightning Detection Network revealed that the large majority of broad-band signals are caused by electromagnetic activity during thunderstorms. Crosscorrelation between microseismic signals and meteorological parameters suggests that rainfalls influence the hydrodynamic conditions of the rock mass and can trigger rockfalls and fracture propagation very quickly since the start of a rainfall event. On the other hand, temperature seems to have no influence on the stability conditions of the monitored cliff. The only sensor deployed on the rock pillar next to the 1969 rockfall scarp typically recorded events with higher amplitude as well as energy. We deem that this is due to seismic amplification phenomena and we performed ambient noise recording sessions to validate this hypothesis. Results confirm that seismic amplification occurs, although we were not able to identify any spectral peak with confidence because the sensors used are not suitable for this task. In addition, we found out that there is a preferential polarization of the wave field along the EW direction and this is in agreement with the geological analysis according to which the pillar is overhanging towards the 1969 rockfall scarp and may preferentially evolve in a wedge failure. Event location was not possible because of the lack of a velocity model of the rock mass. We tried to distinguish between near and far events by analysing the covariance matrix of the threecomponent recordings. Although the parameters and the outcomes of this analysis should be evaluated very carefully, it seems that about 90 per cent of the considered microseismic signals are related to the stability conditions of the monitored area.


476
D. Arosio et al. management (Maxwell 2014), monitoring rock burst and assessing the stress state in mines (e.g. Mendecki 1993), geotechnical engineering (Hardy 2003), analysis of water reservoirs (Simpson et al. 1988), and in the geothermal industry (e.g. Pearson 1981). Regarding geotechnical applications, in the last 15 yr increasing research efforts have been devoted to the study of unstable rock slopes in order to improve our understanding of rock failures that are phenomena characterized by high destructive power and the lack of clearly noticeable forerunners. Indeed, microseismic monitoring can help to develop a predictive capability by observing changes in both the waveforms and the rate of the collected seismic signals. In addition, estimates of the hypocentres of the seismic sources can help to identify the most dangerous zones of the monitored area and therefore to design effective mitigation measures accordingly. Microseismic investigation of unstable rock slopes is generally coupled with other observations, including classical geological mapping, geotechnical monitoring and remote sensing analysis (Arosio et al. 2009). Moreover, meteorological stations are often deployed in the field because they provide data sets that can be correlated with the microseismic records in order to infer possible triggering factors for rock failures. In general, rainfall and seismic activity are deemed to be the most important triggering factors for landslides, especially for soil and porous media (e.g. Mousavi et al. 2011;Regmi et al. 2014). As far as rock slopes are concerned, several studies have highlighted a close relationship between collapses and meteo-climatic parameters (Frayssines & Hantz 2006), although identification of triggering factors is not always straightforward (Walter et al. 2012;Collins & Sock 2016). In the scientific literature related to rockfalls, Occhiena et al. (2012) correlated temperature recordings and microseismic events collected with five 3C geophones at nearly 4000 m a.s.l. on the Matterhorn (NW Alps) discussing that permafrost degradation may be a possible cause of rockfall activity. Similarly, Amitrano et al. (2012) used acoustic emission monitoring to investigate rock damages induced by thermal cycles in a high-alpine rock face focusing on the importance of freezing-induced stresses. Studies on the effect of freeze-thaw cycles on rock fracturing have been performed also at the laboratory scale (e.g. Arosio et al. 2013). Helmstetter & Garambois (2010) found a significant correlation between rainfalls and microseismic events generated by falling rock blocks occurring soon after a rainfall event in the Séchilienne rockslide (southeastern France). They deployed three arrays of geophones and recorded microseismic signals due to both falling rocks and internal fracturing, whose classification was supported by integration with videos collected by a camera continuously observing the slope. Spillmann et al. (2007) installed a network of twelve 3C borehole geophones to monitor a limestone slope where a 30 million m 3 rockfall took place in 1991. They collected more than 60 000 events in a 31 month time interval, that were reduced to 223 microseismic events potentially related to the stability of the slope thanks to a hybrid automatic-manual classification process. Moreover, they successfully locate the hypocentres thanks to a 3D P-wave velocity model of the mountain slope determined from tomographic refraction data and a nonlinear probabilistic location technique. Apart from the Alpine region, microseismic monitoring networks were also deployed to study the stability of Norwegian Fjords (Blikra 2012) and of a coastal cliff in Normandy, Western France (Amitrano et al. 2005).
All the above-mentioned case studies feature difficult logistic conditions, mainly concerning power supply as well as sensor network installation and maintenance across steep and harsh terrains. Sensor deployment is often constrained to locations accessible with reasonable effort, this resulting in suboptimal or dimensionally re-duced network geometry and giving rise to lower sensitivity as well as diminished location capability of the monitoring network. Moreover, seismic tomographic experiments across the monitored area are extremely demanding, and the lack of a reliable velocity model yields larger errors in the estimation of the hypocentres, which in turn affect the estimation of event magnitude and source mechanism.
This work presents a case study in the Italian Prealps, where we are monitoring a section of a steep unstable rock face directly threatening human settlements. We first describe the geological setting and the deployed microseismic network, and then we discuss the classification of signals collected over a 3 yr time span. We correlate collected signals with meteorological data sets in order to support event classification and to uncover possible triggering factors that may lead to rock failure. Finally, we focus on the interpretation of the microseismic events deemed to be related to the stability of the cliff and we draw the conclusions.

G E O L O G I C A L S E T T I N G
Mount San Martino rises up to an elevation of about 1100 m a.s.l. above the town of Lecco (40 km north of Milan, Northern Italy) and is part of the Grigne mountain group in the Orobic Prealps (Fig. 1a). Its rock face looks southwards and features steep and overhanging vertical walls as high as 330 m. Several rockfalls and collapses have been reported in the past, as the first indications can be traced back to the mid-19th century. Numerous and frequent failures with sizes ranging from a few tens to several hundreds of cubic meters took place periodically in correspondence to intense precipitation events, while no clear relationship between failures and temperatures has been established. Instability processes affecting the slope can be put in relation to the presence of the extremely steep face and the severe tectonization undergone by the rock mass.
The most catastrophic event happened during the night of 1969 February 23 when a rock block of about 15 000 m 3 detached from the central section of the rock face and swept away a building, causing the death of seven people and injured three others. After this failure, various activities have been performed in order to ensure the safety of the inhabitants and infrastructures against possible falls. Structural mitigation measures have been implemented by realizing a rockfall protection wall and by installing elastoplastic nets. Furthermore, some of the unstable blocks on the rock face were either detached or anchored with nails and injected epoxy in order to prevent their collapse. Besides structural measures, several studies were performed to identify the sections of the cliff most prone to rockfalls and the structural domain of the slope was investigated so as to identify the cinematically detachable rock blocks (Interreg IIC 2000). Geological mapping was carried out by integrating classical field surveys and remote observations to analyse the main features of the rock mass (Alborghetti & De Maron 1999;Agliardi & Crosta 2003). The outcropping rock belongs to the Calcare di Esino formation (Middle Triassic) and has an almost indistinguishable monocline antidip slope stratification (dip direction 280 • and dip 20 • ). Three systems of discontinuities with orientation N-S and E-W divide the cliff in dihedrals characterized by high degree of instability. The presence of open fractures, counter-slopes and debris material on the ledges, potentially prone to remobilization because of intense meteorological events, evidences the instability of the rock wall. Rock blocks detached from the overhanging walls contributed to form a talus deposit with thickness up to 10 m at the base of the slope. The main geomechanical and structural features of the discontinuities are reported in Figs 1(d) and (e). Kinematic analysis was achieved using the lower hemispherical projection method (Hoek & Bray 1981) to identify the effect of discontinuities on the slope stability. Results show that planar and wedge failures, as well as toppling, are probable.

M O N I T O R I N G N E T W O R K
We installed a 24-bit recording system on the edge of the rock face, approximately 50 m above the 1969 rockfall scarp (Fig. 1). The acquisition board controls five three-component geophones with 28 Hz natural frequency, a rain gauge, two sensors to measure air temperature as well as the temperature within a shallow rock fracture and a GPS receiver. The meteorological sensors are used to study the correlation between meteorological conditions and signals col-lected by the microseismic network. Data collected by the network are temporarily stored on an embedded field PC and automatically downloaded on a daily basis to a PC at Politecnico di Milano via a dedicated 5 GHz Wi-Fi link, which also allows interactive remote access to the on-site field PC.
Three geophones where installed in shallow holes very close to 1969 failure area to effectively monitor the overhanging rock column which is believed to be one of the most dangerous sections of the rock mass (sensors 3, 4 and 5 in Fig. 1). On the contrary, two geophones were deployed in vertical boreholes (sensors 1 and 2 in Fig. 1), 9 and 4.5 m deep, respectively, at the top of the rock face, where the acquisition board is also located (Fig. 1). The two borehole geophones were placed at the bottom of the holes that were successively grouted. The axes of the single sensors within the borehole geophones where aligned to known directions (east-west, north-south, Vertical) thanks to a system of poles properly designed 478 D. Arosio et al. to be connected to the case of the geophones. On the contrary, surface geophones were deployed with arbitrary orientations because of logistic constraints, but their components were rotated back into the predefined reference system (N-E-V) by using a rotation matrix containing the Euler angles. The maximum aperture of the network is along the elevation direction with about 70 m, while north-south and east-west apertures are limited to 15/20 m. Boreholes geophones should benefit from quieter recording conditions, because they are not disturbed by meteorological events and from a better coupling to the investigated medium, since they are less affected by the shallow weathered rock layer.
The acquisition board is continuously acquiring data from the meteorological sensors with a 10 s sampling interval. In addition, maximum and minimum values of the background noise sensed by the seismic sensors are recorded every 10 s. Microseismic events are collected according to a triggering methodology with a 1 kHz sampling frequency. After some tests to evaluate the background noise conditions at the investigated site, we decided to set the triggering threshold as a plain velocity value (0.01 mm s −1 ) slightly above the root-mean-square background noise level. Whenever a single channel of a single geophone senses a value higher than the threshold, the acquisition is triggered on all the geophones of the network. A pre-trigger window of 2 s was also set. The shortcoming of this triggering methodology is that several useless signals may be recorded. Nevertheless, we decided to tolerate a probably high number of false alarms, much to the advantage of detecting any signal possibly related to the stability conditions of the monitored slope.
Deployment operations were completed in February 2013 and the monitoring network has been active since then with some interruptions due to lack of power supply, hardware, and software issues along with maintenance activities.

Manual classification
This work analyses the data collected by the monitoring network in a 3 yr time span, from February 2013 to January 2016. Contrary to what expected, we did not find any striking difference when considering the mean and standard deviation of background noise levels recorded at each geophone location (Fig. 2a). Nonetheless, surface geophones have been triggered definitely more times with respect to borehole ones ( Fig. 2b) because of noise bursts chiefly occurring in the spring-summer period that will be discussed in the following. Having discarded all known spurious signals (e.g. events generated by fireworks, maintenance works, etc.), a total number of 9178 events have been detected by the network.
With the final aim of developing an automatic classification routine, first we carefully analysed all the collected events and manually classified them by considering the features of the signals associated with (1) known events that were reported to the local authorities, (2) preliminary field tests in which active seismic sources were employed (sledge hammer and small dynamite charges), and (3) events described in previous studies (e.g. Lee & Stewart 1981;Spillmann et al. 2007;Helmstetter & Garambois 2010).
Recorded signals have been manually classified according to two main classes: a first one grouping events related to the stability conditions of the slope and a second one clustering all disturbances. In turn, the first group comprises two different subclasses: a first one with microseismic events that are deemed to be related to propagation of rock fractures within the rock mass and to rockfalls (MS events) and a second one related to minor rockfalls with small rocks hitting the rock face close to the geophone locations (local events), thus involving just a limited number of recording channels. The second group comprises the majority of the recorded events ( Fig. 3a) and is mainly composed by broad-band short-time signals (BB signals) in addition to events presenting both microseismic events and broad-band disturbs (mixed events) and other signals with unspecified characteristics (unclassified noise). The outcomes of manual classification point out that the performance of the microseismic network is deeply dominated by the occurrence of BB signals ( Fig. 3a) that are almost totally collected just by the sensors placed at the surface and further from the acquisition board ( Fig. 3b). Fig. 4 depicts different classified events with their characteristics; please note that time-series show signals recorded by the channel with the highest absolute amplitude, while spectrograms have been generated by stacking the spectrograms of all the channels. Microseismic events probably related to fracturing processes inside the rock mass generally have a frequency range of about 10-150 Hz, time duration of few seconds or less, impulsive onset, and a triangular-shaped spectrogram (Figs 4a, b, i and j). Attenuation of higher frequencies has been already pointed out by previous studies (e.g. Spillmann et al. 2007) and is generally due to the presence of severely fractured and altered rock. On the other hand, microseismic signals generated by rockfalls present longer overall time duration and lower frequency band (Figs 4c, d, k and l). During the monitoring period, five main rockfalls affecting the slopes close to the city of Lecco were reported to the local authority (Fig. 1), and two of them were found to be originated from S. Martino rock face. The first rockfall occurred in December 2013 about 200 m west from the monitoring network and involved a rock volume around 10 m 3 . This event (Figs 4c and k) can be easily observed on all the channels that collected signals of comparable amplitude and with the typical signature of bouncing blocks (Helmstetter & Garambois 2010) along with very low-frequency content (<50 Hz). The second rockfall took place in the beginning of January 2016 (Figs 4d and l), when rock blocks most probably with a total volume smaller than 3 m 3 fell just in the area of the monitoring network, close to the unstable rock pillar (Fig. 1b). Again, it is possible to identify the impacts of the falling rocks but, due to the fact that seismic sources are closer to the geophones with respect to the previous rockfall, amplitude differences from geophone to geophone are larger and spectral content is wider. Apart from the abovementioned rockfalls reported to the local authority and recorded by our network (Figs 4c and k; Figs 4d and l), we believe that 26 out of the remaining 140 manually classified MS events may correspond to minor rockfalls occurred in the monitoring period. Indeed, these events show relatively longer duration and multiple signals along the recording probably due to the bouncing rock blocks.
Local events involve just a limited number of channels and generally present multiple signals with a wider spectral content shifted towards higher frequencies (Figs 4e and m). We believe these events are related to the impacts of small rocks, and it is worth pointing out that most of the local events occurred close to geophone 4 (Figs 1 and 2b) that was actually installed on a ledge exposed to rockfalls from the upper section of the cliff. As a matter of fact, geophone 3 and 5 are placed in areas of the cliff where the rock face is actually overhanging. The interpretation of local events was also supported by tests performed by field technicians that artificially generated events with a small hammer directly on the rock face close to the surface geophones during the installation works of the network. Moreover, during maintenance operations, debris was found on the abovementioned rock ledge.
During the process of manual classification, we also looked for the correspondence with signals generated by earthquakes. By checking the national earthquake catalogue, we found out that just a single regional earthquake was recorded by the network (Figs 4f and n). The earthquake hypocentre was estimated to be about 35 km southwest of the monitoring network at 11 km depth. The signal has a very low-frequency content and it is not possible to identify clear first arrivals of the seismic phases. This is also due to the fact that the deployed sensors are unsuitable for this kind of signals, having a natural frequency of 28 Hz.
BB signals are very impulsive signals (spikes) with a band spanning from very low frequency to the maximum frequency allowed by the anti-aliasing filter (Figs 4g and o). Events containing a series of spikes were also collected by the network. BB signals are due to electromagnetic transients (Spillmann et al. 2007) mostly caused by electromagnetic activity during both near and far thunderstorms, as will be further discussed when correlating collected events and meteorological data sets. Mixed events have also been recorded and present a close sequence of BB signals and microseismic signals generated by lightning and the following thunders (Figs 4h and p).

Automatic Classification
When dealing with microseismic events, it is common practice to rely on signal parameters in time and/or frequency domains for automatic classification purposes. A very common approach is to rely on spectrograms since they allow the signals to be jointly evaluated in both domains, although the definition of reference patterns in the time-frequency plane must be performed carefully (e.g. Spillmann et al. 2007).
During the manual classification process, a set of parameters was computed and stored for each classified event, including parameters in the time domain, specifically time duration, maximum absolute amplitude, maximum peak-to-peak amplitude, power, values as well as lags of mutual cross-correlation, and in the frequency domain, namely peak, centroid as well as centroid standard deviation of the amplitude spectrum, minimum and maximum frequency, and frequency bandwidth. It must be pointed out that channels not satisfying the triggering threshold were not used to compute the event parameters.
To develop an automatic classification routine for collected events, we resorted linear discriminant analysis (LDA), which is a supervised machine learning approach that can detect patterns in data, and then uses the uncovered patterns to predict future data. Generally, the goal of pattern recognition is to learn a mapping from inputs to outputs, given a set of labelled input-output pairs, called the training set. More in details, LDA is a parametric classification method that fits a model, called the predictive model, to the training data and then uses this model to classify future data (McLachlan 2004). In our classification routine, inputs are 12-dimensional vectors of numbers corresponding to the signal parameters extracted during the manual classification procedure, while outputs may be the five classes in which the collected signals are grouped (Fig. 3a). To evaluate the performance of the automatic classification, it is useful to define the Hit Rate (HR) and the False Alarm Rate (FAR): where Hits (H) is the number of MS events correctly identified, Misses (M) is the number of MS events not identified, False Alarms (FA) is the number of events incorrectly identified as MS events and Correct Rejections (CR) is the number of events correctly identified as non-MS events. Obviously the major goal of the automatic routine is to have a high HR and a tolerable FAR so that the process of manually scanning the collected data sets is optimized and we get as much information as possible related to the stability conditions of the rock face.
The search for the predictive model through the discriminant analysis approach has been performed by randomly choosing training data sets of different sizes, namely with 5 to 30 inputs for each of the previously identified classes. Random extraction was repeated 50 times for each training set, so that discriminant analysis was performed 1300 times in total and for each size of the training sample the mean and the standard deviations of HR and FAR were com-puted. Fig. 5 shows the results obtained for the class of MS events. It can be observed that with training sets as small as 10 inputs HR and FAR of 96.2 per cent and 1.1 per cent are obtained, respectively. No important improvements are obtained for bigger training sets as mean values and standard deviations are more or less constant. We also attempted to apply principal component analysis (PCA) in order to identify the most promising signal parameters and reduce the dimensionality of the parameter vector for the LDA. Anyway, we found no significant improvements in HR and FAR values for the MS events, when using just a small subset of parameters identified by the PCA and explaining most of the variance in the parameters' space.
According to the obtained results, signals collected by the network are now scanned with the automatic classification routine directly on the embedded field PC. In this way, just events potentially associated with the stability of the slope are transmitted remotely for further analysis.

C O R R E L AT I O N W I T H M E T E O RO L O G I C A L DATA S E T S
The rain gauge installed on the mountain was unfortunately affected by inaccurate measures because of leaves and small insects frequently falling into the funnel. However, we could obtain rainfall time-series from a meteorological station maintained by the Regional Environmental Agency located just 1 km southeast of the monitoring network that samples data on an hourly basis. Although the thermometer deployed in the shallow fracture suffered from severe maintenance problems because of damages caused by rodents, we were able to observe that temperature sensed in the shallow fracture varies within a smaller range with respect to the air one and minimum values across the monitoring period have seldom been below 0 • C. This suggests freeze-thaw cycles could not act as possible triggering factor for rockfalls as we initially argued. On the other hand, it is clear that most of the signals recorded by the network are related to rainfalls occurring in the spring-summer period (Fig. 6). The very impulsive signals recorded by the network are deemed to be caused by lightning during thunderstorms and, to a minor extent, other electrical disturbances associated with the high resistivity of the limestone rock formation and the long recording cables. Indeed, almost all the spike-like signals were recorded just by the surface geophones that are connected to the longest cables.
To corroborate this hypothesis, we resorted to cross-correlation, which is a mathematical operator able to evaluate the similarity and the time lag between two variables, with the aim of comparing broad-band signals recorded by the network with data sets collected by the Italian Lightning Detection Network (CESI-SIRF R ). This network consists of broad-band electromagnetic field sensors covering Italy with homogeneous efficiency of 95 per cent and about 50-60 per cent for cloud-to-ground and cloud-to-cloud events, respectively. Fig. 7(a) shows lightings collected on 2015 October 15 within about 30 km from the monitoring system, that have a significant zero-lag maximum cross-correlation with the time occurrence of both broad-band signals and mixed events (Figs 7b and  c). By analysing thunderstorms occurred on different days, we actually found out that the number of detected lightning is generally higher than that of broad-band signals recorded by the geophones. As a matter of fact, we observed that in many instances lightning occurs in a very close sequence, with delays spanning from fractions of microseconds to hundreds of milliseconds. As a result, considering the sampling frequency and the minimum time window of our recording system, most sequences are detected as a single 482 D. Arosio et al.   event. This also prevented us to study the detectability of lightings (i.e. the fact that lightning strikes were recorded as broad-band signals in our monitoring system) versus their current intensity, the polarity and type (positive, negative and intracloud), along with the (azimuthal) location with respect to the microseismic monitoring network. So it is still unclear why some lightning generates disturbances that are not detected by our network. On the other hand, days with more broad-band signals than lightning are probably due to the limited extent of the lightning source area we considered.
To quantitatively study the influence of meteorological parameters as possible triggering factor for fracture propagation and rockfall activity, we resorted to cross-correlation again. Before computing cross-correlation, reference time differences between data sets were adjusted and missing or unreliable values due to network down periods and to recording malfunctioning were discarded in both microseismic and meteorological data sets so that they did not affect the final results. Data sets were first detrended by removing the mean values and normalized by dividing by their standard deviation so that the output of the cross-correlation ranges from −1, for variables with matching trends but opposite polarities, to 1, for perfect similarity. Moreover, cross-correlation at zero lag is a measure of the linear dependence of the variables being cross-correlated. Fig. 8(a) shows that MS events are correlated with rainfalls since we obtain a weak (0.15) but significant cross-correlation maximum for zero lag. This suggests that rainfalls, acting on the hydrodynamic conditions of the rock mass, can trigger rockfalls and fracture propagation very quickly since the start of the rainfall event. The fact that cross-correlation maximum is very impulsive and symmetric also indicates that instability processes and rainfalls occur almost simultaneously. Actually, the structural analysis of the cliff reveals that the characteristics of the joint sets (orientation, high values of persistence, density and connections) favour water circulation within the rock mass. Efficient fluid flow through the area under investigation suggests that rainfall may significantly affect slope stability. To evaluate the significance of the cross-correlation maximum, we computed the Pearson correlation coefficient (i.e. the zero-lag cross-correlation of the two data sets considered as random variables) and verified their linear dependence by computing the p-value for testing the hypothesis that there is no relationship between the observed variables. We obtained a p-value almost equal to zero, that is smaller than the significance level of 0.05, below which the corresponding correlation is commonly considered significant.
Since cross-correlation can emphasize periodic trends in the recordings, results concerning MS events and hourly temperatures is strongly dominated by the periodic trend of the latter. This is evident primarily when considering the long-term yearly cycle, that is also somehow present in the recorded events (Fig. 6a) and thus heavily affects both value and lag of cross-correlation maximum, and, to a minor extent, when taking into account the short-term daily cycle. Both these periodic trends are clearly noticeable as peaks in the temperature amplitude spectra with a frequency of about 3.17 × 10 −8 Hz and 1.16 × 10 −5 Hz, respectively. To remove the influence of the yearly cycle, we computed the cross-correlation between hourly MS events and the temperature derivative approximated by finite difference evaluated over 1 hr time interval. Results in Fig. 8(a) again show that there is a significant negative peak in the cross-correlation at zero lag and, obviously, short-term daily cycles are noticeable. Anyway it must be pointed out that the correlation between temperature and MS events does not imply a dependence of the latter on the former, but it is very likely due to the fact that rainfalls are generally associated with temperature drops. This is corroborated by the negative correlation between rainfall and temperature (Fig. 8b) and by the fact that MS events were triggered within a wide range of temperatures. In this case the slightly asymmetric cross-correlation peak indicates that temperature takes some time to rise after the end of a rainfall event.   Table 1 lists the values of mean and standard deviation of the parameters computed for the MS events, considering the channel with the highest absolute amplitude, except for the parameters concerning cross-correlation that are relative to the maximum crosscorrelation value obtained among all the mutual cross-correlations between recording channels. Duration has been computed according to a modified version of the classic short-term-average/long-termaverage (STA/LTA) algorithm (Lee & Stewart 1981) applied to the envelope of the collected signals, while frequency limits are referring to the −6 dB values with respect to the peak of the amplitude spectrum. MS events typically last a few seconds. Although standard deviations of frequency parameters are large with respect to the corresponding mean values, MS events have frequency content spanning between 10 and 150 Hz approximately. It is interesting to note that cross-correlation values and lags are rather low and large respectively, this suggesting the rock mass is severely weathered and causes significant distortion of the propagating waveforms along with very low propagation velocities (Helmstetter & Garambois 2010;Levy et al. 2011). This is also supported by the large standard deviations of the collected amplitudes, although these values are also dependent upon the varying distance of the microseismic sources from the receivers (Arosio 2010). Contrary to what expected, geophone 4 is the only sensor that was triggered by all the 142 collected MS events, while geophones 1, 2, 3 and 5 have been triggered 140, 117, 87 and 59 times, respectively. This fact is also confirmed by having a closer look at the behaviour of the different sensors in terms of recorded maximum amplitude and power computed as

A N A LY S I S O F M I C RO S E I S M I C E V E N T S
where A is the recorded amplitude value, T is the time duration of the event and the subscripts i and j indicate the time sample along the recorded signal and the components of each geophone. In Fig. 9, we can observe a clear trend, revealing that borehole sensors 1 and 2 present lower values with respect to geophone 4 placed at the surface. On the contrary, geophones 3 and 5 show the worst performance in line with the fact that they are installed at the surface where the rock is more weathered. Although geophone 2 is placed at greater depth, it is near to a zone of water accumulation and this may cause the presence of weathered rock in the surroundings. Since amplitudes and arrival times are correlated even in highly heterogeneous media as fractured rock masses (Arosio 2010;Occhiena et al. 2012), we also attempted to analyse the first breaks of the MS events at the different geophones. Unfortunately, an appropriate analysis was prevented because of difficult picking operations due to unsatisfactory signal-to-noise ratio (SNR) of many collected events along with low-frequency precursory signals that in some cases made picking rather questionable. It is unlikely that regular highest values on sensor 4 are due to microseismic sources systematically closer to this geophone (see values for rockfalls and earthquake reported in Fig. 9). Also, particularly favourable propagation conditions to sensor 4 disagree with the fact that the sensor is installed at the surface and almost on top of a weathered unstable pillar partially isolated by a wide fracture from the rock mass (Fig. 1). Instead, resonance/amplification phenomena have been recently reported in the scientific literature (Burjánek et al. 2010;Levy et al. 2010;Arosio et al. 2017) when sensors are deployed on unstable rock pillars. To this concern, we remotely triggered recording sessions to collect ambient noise on days with quiet weather conditions, with neither wind nor rainfall. Acquisition time window and sampling frequency were set to 600 s and 100 Hz, respectively. After rotating the components, we observed that channel 4X always has the highest energy and this is also confirmed in the frequency domain when looking at the amplitude spectra. As expected, the computed spectra are heavily influenced by the amplitude transfer function of the geophone used, that is monotonically increasing up to about 70 Hz. Obviously, amplitude spectra are attenuated by the antialias filter when approaching the Nyquist frequency (i.e. 50 Hz). We also applied a standard processing sequence in order to compute the horizontal-to-vertical spectral ratio (HVSR), consisting of dividing the raw recording into shorter windows and computing the amplitude spectra for each window, smoothing the spectra with the function proposed by Konno & Ohmachi (1998), merging the horizontal components with the geometric mean, computing the HVSR, and finally averaging the obtained spectral ratios for all the time windows. Results show that there are no peaks associated with resonance phenomena, but HVSR of geophone 4 is around 2 in the considered frequency range (Fig. 10a), while HVSRs of the other sensors are around or smaller than 1. Beside spectral amplification, it is possible to study seismic wave polarization occurring in the direction of maximum rock displacement (Arosio et al. 2017) by computing either amplitude spectra or HVSR as a function of azimuth in the horizontal plane, that is, by rotating and summing the horizontal components. Results displayed in Fig. 10(b) indicate that there is a direction of preferential polarization approximately along the 80 • -260 • direction. Moreover, if we remove possible source effects by deconvolving the signals collected by sensor 4 with the signals collected by the closest sensor on the rock mass, that is geophone 3, we may obtain a clearer image of the wave field polarization, indicating that the pillar seems to oscillate with maximum displacement along the E-W direction and a resonance frequency of about 2.3 Hz (Fig. 10c). Fig. 10(c) also shows that there could be lower harmonics along the same direction, although it must be pointed out that a reliable analysis of the resonance frequency should be carried out with sensitive low-frequency sensors.
When considering the collected MS events, it is interesting to note that in most of the cases (85 per cent) channel 4X still features the maximum power although the amplitude of the collected signals is strongly influenced by both the relative location of the source with respect to the receivers of the network and the source mechanism that modifies the radiation pattern of seismic waves. Similar results were also obtained in case of fireworks fired in the city of Lecco.
We deem the preferential direction of oscillation of the pillar along the E-W direction is due to the lack of mass corresponding to the 1969 rockfall scarp just East of the pillar, together with the shape of the pillar itself showing a structure curved towards the scarp (Fig. 1). The direction of oscillation is in agreement with the output of kinematic analysis that indicates a wedge failure mechanism for the dihedral pillar.
Low accuracy of picked first breaks and high distortion of waveforms collected throughout the sensor array offer little chance to reliably locate MS events when using either an arrival-time approach or an energy-focusing approach, respectively. In addition, no accurate velocity model of the rock mass is currently available and previous works (e.g. Spillmann et al. 2007;Helmstetter & Garambois 2010) pointed out that, for a fractured rock mass, a homogenous model is unsuitable to provide event location with little errors. Therefore, at the present stage, we just attempted to distinguish among near and far events, that is, among events possibly related to the stability 486 D. Arosio et al. conditions of the monitored face and other seismic events. This was carried out by dividing the three-component recordings into smaller time windows and by studying the eigenvectors of the covariance matrix computed for each window (Flinn 1965) in order to identify distinct P-and S-wave arrivals. Whenever a dominant eigenvector is found, the processed window presents linear polarization and thus features the arrival of body waves. More in details, the rectilinearity function (Flinn 1965) where λ 1 and λ 2 are the first and second eigenvalues, is evaluated to detect any incoming body wave, while the orthogonality of dominant eigenvectors found at different times is used to identify S-waves. Whenever it is possible to recognize distinct P-and S-wave arrivals, it is assumed that the corresponding event originated far from the monitoring network. Events were first filtered with a zero-phase band-pass filter and then the analysis was performed on the geophone with the highest energy only. Polarization analysis was carried out with different thresholds for both rectilinearity and orthogonality (from 0.90 to 0.95), with windows either of fixed duration or tuned on the spectral peak of the event as well as with different window overlapping. In addition, whenever P-and S-wave polarizations were identified, we also checked that hodograms within a 15 ms time window could be linearly fitted with a satisfactory misfit and that the regression line matched the direction identified by the dominant eigenvector. As far as the misfit is concerned, we took into account R-squared, the p-value and the standard error of the regression (S) to assess the goodness of the linear regression (Figs 11b and c). Both R-squared and S provide an overall measure of how well the regression line fits the data or, in other words, how close the observations are to the regression line, while p-value is used to test the linear relationship between two variables (the velocity of particle displacement recorded by two geophone components in our case). Unfortunately, both R-squared and p-value fail to provide valuable information about the goodness of the linear regression model when observations have nearly zero mean and that is why we took into account S as well. Our findings suggest that this analysis is very sensitive to different thresholds and sliding time windows and must be carefully supervised by a skilled operator, especially when processing microseismic events with low SNR. In many instances, P and S arrivals identified with the covariance matrix do not seem to correspond to any clear wave arrival and, although constraints on the linear regression of the hodograms are fulfilled, direct inspection of both the hodograms and of the seismic event projected along the P and S directions may provide questionable results (Fig. 11). Polarization analysis indicates that just a few (<10) of the classified MS events have reliable distinct P and S arrivals, with delays ranging from a few tenths to a few hundreds of milliseconds. Therefore, this conclusion seems to suggest that most of the seismicity recorded by the network is related to the stability of the monitored area.

C O N C L U S I O N S
A small microseismic network consisting of five 3C-geophones has been installed on a rock face threatening the city of Lecco, in the Italian Prealps. We processed and analysed more than 9000 events collected in a 3 yr time span starting from February 2013 in order to gain an understanding of the stability conditions of the monitored slope. We found out that most of the collected signals are to be discarded because they are due to electromagnetic activity related to thunderstorms. To ease this operation, we first manually classified the events collected and then developed an automatic classification routine according to a pattern recognition algorithm based on LDA. Figure 11. (a) Components of an MS events recorded by geophone 4 and projections of the components along P and S directions identified by the polarization analysis. (b) and (c) display hodograms for P and S components respectively. In each hodogram plot, black square is the starting position, small dots are following positions, black solid line is the linear regression of the trajectory, thick grey line is the direction corresponding to the dominant eigenvector and dashed black lines are ± 2 times the standard error of the regression from the regression line. Each plot also lists R-squared, p-value, the percentage of positions within plus/minus 2 times the standard error of the regression from the regression line (S-bound) and the angular difference in degrees between the regression line and the dominant eigenvector ( ϑ).
The developed routine has proved to have a hit rate percentage higher than 95 per cent and a tolerable false alarm rate and it is now used to discard useless events directly on the embedded field PC of the acquisition board.
Rainfalls are likely to be the most probable triggering factor and microseismic events are triggered immediately after a rainfall episode starts. Contrary to what expected, temperature does not seem to play any direct role in controlling the stability of the rock face.
Analysis of collected MS events reveals that the sensor installed on the rock pillar west of the 1969 rockfall scarp commonly features the highest amplitude and we argue this may be caused by amplification phenomena when seismic energy solicits the pillar. To support this interpretation, we performed ambient noise recordings and processed the data to evaluate horizontal-to-vertical spectral ratio and wave field polarization. Results confirm that seismic amplification is occurring, although we were not able to identify any spectral peak with confidence because the sensors used are not suitable for this task. In addition, we found out that there is a preferential polarization of the wave field along the EW direction and this is agreement with the geological interpretation according to which the pillar is overhanging towards the 1969 rockfall scarp (i.e. eastwards) and thus may preferentially evolve in a wedge failure (Fig. 1e).
Location of MS events was not performed because a velocity model of the rock mass is currently missing. In addition, we found very difficult to estimate accurate first arrivals because of low SNR of the collected signals. In particular, we found that in many instances there was no clear first break but precursory lowamplitude onsets and picking on the channels with lower SNR resulted in excessively high time differences with respect to channels with higher SNR. Also, we observed large changes in signal amplitude and shape from sensor to sensor probably due to highly heterogeneous media and small source distances with respect to the aperture of the network. This last aspect was also corroborated by the polarization analysis we performed by mean of the covariance matrix method that indicates about 90 per cent of the MS events originated within the monitored area. Nevertheless, it must be pointed out that polarization analysis should be evaluated carefully, especially when processing low-SNR microseismic signals.
We will now focus on a seismic tomography field campaign to generate a velocity model of the rock mass. Moreover, enlargement of the monitoring network is planned in order to increase spatial sampling of the events, tackle the dimensionality issue of the network and record higher SNR signals. This will allow higher accuracy in the source localization process. We are also performing time-lapse photogrammetric surveys in order to be able to correlate estimated source positions with rock block detachment areas detected at the surface. Finally, a reliable location of MS events will allow for magnitude estimation and source mechanism 488 D. Arosio et al. investigation to corroborate the hypothesis about the failure mechanism of the monitored rock pillar.